Can users consent to TeamsTab.ReadWriteForUser themselves?

Yes, this delegated permission allows user consent. Users can grant this permission during sign-in without admin approval.

How do I add TeamsTab.ReadWriteForUser to my app registration?

Go to Azure Portal > App registrations > Your app > API permissions > Add permission > Microsoft Graph, then search for TeamsTab.ReadWriteForUser and select it.

TeamsTab.ReadWriteForUser Permission - Microsoft Graph API

Permission Details

Delegated Permission

Allow the Teams app to manage all tabs for a user

Allows a Teams app to read, install, upgrade, and uninstall all tabs for the signed-in user.

Permission ID: c37c9b61-7762-4bff-a156-afc0005847a0

Properties

Property	Type	Description
`id`	`string`	The unique identifier for an entity. Read-only.
`teamsApp`	`object`	The application that is linked to the tab.
`webUrl`	`string`Nullable	Deep link URL of the tab instance. Read only.
`teamsAppId`	`string`Nullable	App definition identifier of the tab. This value can't be changed after tab creation. Because this property is deprecated, we recommend expanding teamsApp to retrieve the application that is linked to the tab.
`messageId`	`string`Nullable
`configuration`	`object`	Container for custom settings applied to a tab. The tab is considered configured only once this property is set.
`sortOrderIndex`	`string`Nullable	Index of the order used for sorting tabs.
`displayName`	`string`Nullable	Name of the tab.

JSON Representation

JSON representation

{
  "id": "String",
  "teamsApp": "{...}",
  "webUrl": "String",
  "teamsAppId": "String",
  "messageId": "String",
  "configuration": "{...}",
  "sortOrderIndex": "String",
  "displayName": "String"
}

Graph Methods

Delegated access App-only access

No API methods available for this version.

No PowerShell cmdlets found for this permission.

Code Examples

C# / .NET SDK

// Install: dotnet add package Microsoft.Graph
// Install: dotnet add package Azure.Identity
using Microsoft.Graph;
using Azure.Identity;

// Delegated permissions - interactive user sign-in
var scopes = new[] { "TeamsTab.ReadWriteForUser" };
var options = new InteractiveBrowserCredentialOptions
{
    ClientId = "YOUR_CLIENT_ID",
    TenantId = "YOUR_TENANT_ID",
    RedirectUri = new Uri("http://localhost")
};
var credential = new InteractiveBrowserCredential(options);
var graphClient = new GraphServiceClient(credential, scopes);

// Example: GET /me
var result = await graphClient.Me.GetAsync();
Console.WriteLine($"User: {result?.DisplayName}");

JavaScript / TypeScript

// npm install @azure/msal-browser @microsoft/microsoft-graph-client
import { PublicClientApplication } from "@azure/msal-browser";
import { Client } from "@microsoft/microsoft-graph-client";
import { AuthCodeMSALBrowserAuthenticationProvider } from 
    "@microsoft/microsoft-graph-client/authProviders/authCodeMsalBrowser";

const msalConfig = {
    auth: {
        clientId: "YOUR_CLIENT_ID",
        authority: "https://login.microsoftonline.com/YOUR_TENANT_ID"
    }
};

const pca = new PublicClientApplication(msalConfig);
await pca.initialize();

// Delegated: Login with required scope
const loginResponse = await pca.loginPopup({
    scopes: ["TeamsTab.ReadWriteForUser"]
});

const authProvider = new AuthCodeMSALBrowserAuthenticationProvider(pca, {
    account: loginResponse.account,
    scopes: ["TeamsTab.ReadWriteForUser"],
    interactionType: "popup"
});

const graphClient = Client.initWithMiddleware({ authProvider });

// Example: GET /me
const result = await graphClient.api("/me").get();
console.log(result);

PowerShell

# Install Microsoft Graph PowerShell module
Install-Module Microsoft.Graph -Scope CurrentUser

# Delegated access - interactive sign-in
Connect-MgGraph -Scopes "TeamsTab.ReadWriteForUser"

# Verify connection
Get-MgContext | Select-Object Account, TenantId, Scopes

# Example: GET /me
$result = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/v1.0/me"
$result | ConvertTo-Json -Depth 5


# Always disconnect when done
Disconnect-MgGraph

Python

# pip install msgraph-sdk azure-identity
from azure.identity import InteractiveBrowserCredential, ClientSecretCredential
from msgraph import GraphServiceClient
import asyncio

# Delegated permissions - interactive browser sign-in
credential = InteractiveBrowserCredential(
    client_id="YOUR_CLIENT_ID",
    tenant_id="YOUR_TENANT_ID"
)
scopes = ["TeamsTab.ReadWriteForUser"]
client = GraphServiceClient(credential, scopes)

async def get_data():
    # Example: GET /me
    result = await client.me.get()
    print(f"User: {result.display_name}")
    return result

asyncio.run(get_data())

App Registration

1

Navigate to Azure Portal

Go to App registrations in Microsoft Entra admin center

2

Add API Permission

Select your app → API permissions → Add a permission → Microsoft Graph

3

Select Permission Type

Choose Delegated permissions and search for TeamsTab.ReadWriteForUser

4

Grant Admin Consent

Users can consent to this permission themselves during sign-in.